# microweber/microweber (Packagist) vulnerabilities

106 known vulnerabilities (5 critical, 27 high, 61 medium, 3 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/microweber/microweber

## Advisories (106)

### [CVE-2026-12198](https://cve.now/CVE-2026-12198): Microweber API Endpoint thumbnail\_img userfiles\_path path traversal

- Severity: Medium 6.9
- Published: Jun 15, 2026
- Affected: through 2.0.20.

### [CVE-2025-70792](https://cve.now/CVE-2025-70792): Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19.

- Severity: Medium 6.1
- Published: Feb 5, 2026
- Affected: fixed in 2.0.20.

### [CVE-2025-70791](https://cve.now/CVE-2025-70791): Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19.

- Severity: Medium 6.1
- Published: Feb 5, 2026
- Affected: fixed in 2.0.20.

### [CVE-2025-51504](https://cve.now/CVE-2025-51504): Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field.

- Severity: High 7.6
- Published: Aug 1, 2025
- Affected: from 2.0.0, through 2.0.19.

### [CVE-2025-51502](https://cve.now/CVE-2025-51502): Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary…

- Severity: Medium 6.1
- Published: Aug 1, 2025
- Affected: from 2.0.0, through 2.0.19.

### [CVE-2025-51501](https://cve.now/CVE-2025-51501): Reflected Cross-Site Scripting (XSS) in the id parameter of the live\_edit.module\_settings API endpoint in Microweber CMS2.0 allows…

- Severity: Medium 6.1
- Published: Aug 1, 2025
- Affected: from 2.0.0, through 2.0.19.

### [CVE-2025-51503](https://cve.now/CVE-2025-51503): A Stored Cross-Site Scripting (XSS) vulnerability in Microweber CMS 2.0 allows attackers to inject malicious scripts into user profile…

- Severity: High 7.6
- Published: Jul 31, 2025
- Affected: from 2.0.0, through 2.0.19.

### [CVE-2025-34076](https://cve.now/CVE-2025-34076): Microweber CMS Authenticated Local File Inclusion via Backup API

- Severity: Medium 6.1
- Published: Jul 2, 2025
- Affected: fixed in 1.2.11.

### [CVE-2025-2214](https://cve.now/CVE-2025-2214): Microweber Settings index.php cross site scripting

- Severity: Medium 5.1
- Published: Mar 11, 2025
- Affected: through 2.0.19.

### [CVE-2024-33299](https://cve.now/CVE-2024-33299): Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the First Name and Last…

- Severity: Medium 4.7
- Published: Jan 10, 2025
- Affected: through 2.0.9.

### [CVE-2024-33298](https://cve.now/CVE-2024-33298): Microweber Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the create new…

- Severity: Medium 6.1
- Published: Jan 10, 2025
- Affected: through 2.0.9.

### [CVE-2024-33297](https://cve.now/CVE-2024-33297): Cross Site Scripting vulnerability in Microweber v.2.0.9 allows a remote attacker to execute arbitrary code via the campaign Name…

- Severity: Medium 4.7
- Published: Jan 10, 2025
- Affected: through 2.0.9.

### [CVE-2024-40101](https://cve.now/CVE-2024-40101): A Reflected Cross-site scripting (XSS) vulnerability exists in '/search' in microweber 2.0.15 and earlier allowing unauthenticated remote…

- Severity: High 7.2
- Published: Aug 6, 2024
- Affected: fixed in 2.0.16.

### [CVE-2024-41381](https://cve.now/CVE-2024-41381): microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\\modules\\settings\\admin.php.

- Severity: Medium 6.1
- Published: Aug 5, 2024
- Affected: through 2.0.16.

### [CVE-2024-41380](https://cve.now/CVE-2024-41380): microweber 2.0.16 was discovered to contain a Cross Site Scripting (XSS) vulnerability via userfiles\\modules\\tags\\add\_tagging\_tagged.php.

- Severity: Medium 6.1
- Published: Aug 5, 2024
- Affected: through 2.0.16.

### [CVE-2023-6832](https://cve.now/CVE-2023-6832): Business Logic Errors in microweber/microweber

- Severity: Medium 6.0
- Published: Dec 15, 2023
- Affected: fixed in 2.0.0.

### [CVE-2023-6599](https://cve.now/CVE-2023-6599): Missing Standardized Error Handling Mechanism in microweber/microweber

- Severity: Low 3.1
- Published: Dec 8, 2023
- Affected: fixed in 2.0.0.

### [CVE-2023-48122](https://cve.now/CVE-2023-48122): An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.

- Severity: Unrated
- Published: Dec 8, 2023
- Affected: from 2.0.1, fixed in 2.0.4.

### [CVE-2023-6566](https://cve.now/CVE-2023-6566): Business Logic Errors in microweber/microweber

- Severity: Medium 5.9
- Published: Dec 7, 2023
- Affected: fixed in 2.0.0.

### [CVE-2023-49052](https://cve.now/CVE-2023-49052): File Upload vulnerability in Microweber v.2.0.4 allows a remote attacker to execute arbitrary code via a crafted script to the file upload…

- Severity: Unrated
- Published: Nov 30, 2023
- Affected: through 2.0.4.

### [CVE-2023-47379](https://cve.now/CVE-2023-47379): Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.

- Severity: Unrated
- Published: Nov 8, 2023
- Affected: fixed in 2.0.3.

### [CVE-2023-5976](https://cve.now/CVE-2023-5976): Improper Access Control in microweber/microweber

- Severity: Medium 4.6
- Published: Nov 7, 2023
- Affected: fixed in 2.0.0.

### [CVE-2023-5861](https://cve.now/CVE-2023-5861): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 6.4
- Published: Oct 31, 2023
- Affected: fixed in 2.0.0.

### [CVE-2023-5318](https://cve.now/CVE-2023-5318): Use of Hard-coded Credentials in microweber/microweber

- Severity: Medium 5.8
- Published: Sep 30, 2023
- Affected: through 1.3.4.

### [CVE-2023-5244](https://cve.now/CVE-2023-5244): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: Medium 5.0
- Published: Sep 28, 2023
- Affected: through 1.3.4.

### [CVE-2023-3142](https://cve.now/CVE-2023-3142): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Low 3.8
- Published: Jun 7, 2023
- Affected: through 1.3.4.

### [CVE-2023-2240](https://cve.now/CVE-2023-2240): Improper Privilege Management in microweber/microweber

- Severity: High 8.8
- Published: Apr 22, 2023
- Affected: fixed in 1.3.4.

### [CVE-2023-2239](https://cve.now/CVE-2023-2239): Exposure of Private Personal Information to an Unauthorized Actor in microweber/microweber

- Severity: High 7.1
- Published: Apr 22, 2023
- Affected: fixed in 1.3.4.

### [CVE-2023-2014](https://cve.now/CVE-2023-2014): Cross-site Scripting (XSS) - Generic in microweber/microweber

- Severity: Medium 5.3
- Published: Apr 13, 2023
- Affected: fixed in 1.3.3.

### [CVE-2023-1881](https://cve.now/CVE-2023-1881): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: High 7.4
- Published: Apr 5, 2023
- Affected: fixed in 1.3.3.

### [CVE-2023-1877](https://cve.now/CVE-2023-1877): Command Injection in microweber/microweber

- Severity: Medium 6.1
- Published: Apr 5, 2023
- Affected: fixed in 1.3.3.

### [CVE-2023-1081](https://cve.now/CVE-2023-1081): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 5.7
- Published: Feb 28, 2023
- Affected: through 1.3.2.

### [CVE-2021-32856](https://cve.now/CVE-2021-32856): Microweber vulnerable to Cross-site Scripting

- Severity: Medium 6.1
- Published: Feb 20, 2023
- Affected: through 1.2.12.

### [CVE-2023-0608](https://cve.now/CVE-2023-0608): Cross-site Scripting (XSS) - DOM in microweber/microweber

- Severity: Medium 6.3
- Published: Feb 1, 2023
- Affected: fixed in 1.3.2.

### [CVE-2022-4732](https://cve.now/CVE-2022-4732): Unrestricted Upload of File with Dangerous Type in microweber/microweber

- Severity: Medium 4.7
- Published: Dec 24, 2022
- Affected: fixed in 1.3.2.

### [CVE-2022-4647](https://cve.now/CVE-2022-4647): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 5.1
- Published: Dec 22, 2022
- Affected: through 1.3.1.

### [CVE-2022-4617](https://cve.now/CVE-2022-4617): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: Low 2.7
- Published: Dec 21, 2022
- Affected: through 1.3.1.

### [CVE-2022-0698](https://cve.now/CVE-2022-0698): Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.

- Severity: Medium 6.1
- Published: Nov 25, 2022
- Affected: through 1.3.1.

### [CVE-2022-33012](https://cve.now/CVE-2022-33012): Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack.

- Severity: High 8.8
- Published: Nov 22, 2022
- Affected: through 1.2.15.

### [CVE-2022-3245](https://cve.now/CVE-2022-3245): Code Injection in display of tag title on saving tags in microweber/microweber

- Severity: Medium 4.3
- Published: Sep 20, 2022
- Affected: fixed in 1.3.2.

### [CVE-2022-3242](https://cve.now/CVE-2022-3242): HTML code Injection in template search keyword in microweber/microweber

- Severity: Medium 4.3
- Published: Sep 20, 2022
- Affected: fixed in 1.3.2.

### [CVE-2022-2777](https://cve.now/CVE-2022-2777): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 6.6
- Published: Aug 11, 2022
- Affected: fixed in 1.3.1.

### [CVE-2022-2470](https://cve.now/CVE-2022-2470): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: Medium 6.5
- Published: Jul 22, 2022
- Affected: fixed in 1.2.21.

### [CVE-2022-2495](https://cve.now/CVE-2022-2495): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 6.8
- Published: Jul 22, 2022
- Affected: fixed in 1.2.20.

### [CVE-2022-2368](https://cve.now/CVE-2022-2368): Authentication Bypass by Spoofing in microweber/microweber

- Severity: Medium 6.5
- Published: Jul 11, 2022
- Affected: fixed in 1.2.21.

### [CVE-2022-2353](https://cve.now/CVE-2022-2353): Cross-Site Request Forgery (CSRF) in microweber/microweber

- Severity: Medium 6.3
- Published: Jul 9, 2022
- Affected: fixed in 1.2.20.

### [CVE-2022-2300](https://cve.now/CVE-2022-2300): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 6.3
- Published: Jul 4, 2022
- Affected: fixed in 1.2.19.

### [CVE-2022-2280](https://cve.now/CVE-2022-2280): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 6.5
- Published: Jul 1, 2022
- Affected: fixed in 1.2.19.

### [CVE-2022-2252](https://cve.now/CVE-2022-2252): Open Redirect in microweber/microweber

- Severity: Medium 4.3
- Published: Jun 29, 2022
- Affected: fixed in 1.2.19.

### [CVE-2022-2174](https://cve.now/CVE-2022-2174): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: Medium 6.5
- Published: Jun 22, 2022
- Affected: fixed in 1.2.18.

### [CVE-2022-2130](https://cve.now/CVE-2022-2130): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: Medium 6.5
- Published: Jun 20, 2022
- Affected: through 1.2.17.

### [CVE-2022-1631](https://cve.now/CVE-2022-1631): Users Account Pre-Takeover or Users Account Takeover. in microweber/microweber

- Severity: Medium 6.8
- Published: May 9, 2022
- Affected: fixed in 1.2.15.

### [CVE-2022-1584](https://cve.now/CVE-2022-1584): Reflected XSS in microweber/microweber

- Severity: Medium 6.3
- Published: May 4, 2022
- Affected: fixed in 1.2.16.

### [CVE-2022-1555](https://cve.now/CVE-2022-1555): DOM XSS in microweber ver 1.2.15 in microweber/microweber

- Severity: High 8.8
- Published: May 4, 2022
- Affected: through 1.2.15.

### [CVE-2022-1504](https://cve.now/CVE-2022-1504): XSS in /demo/module/?module=HERE in microweber/microweber

- Severity: Medium 6.3
- Published: Apr 27, 2022
- Affected: fixed in 1.2.15.

### [CVE-2022-1439](https://cve.now/CVE-2022-1439): Reflected XSS on demo.microweber.org/demo/module/ in microweber/microweber

- Severity: Medium 6.3
- Published: Apr 22, 2022
- Affected: fixed in 1.2.15.

### [CVE-2022-1036](https://cve.now/CVE-2022-1036): Able to create an account with long password leads to memory corruption / Integer Overflow in microweber/microweber

- Severity: Medium 5.3
- Published: Mar 22, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0968](https://cve.now/CVE-2022-0968): The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a…

- Severity: High 7.2
- Published: Mar 15, 2022
- Affected: through 1.2.11.

### [CVE-2022-0963](https://cve.now/CVE-2022-0963): Unrestricted XML Files Leads to Stored XSS in microweber/microweber

- Severity: Medium 5.7
- Published: Mar 15, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0961](https://cve.now/CVE-2022-0961): The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial…

- Severity: High 7.1
- Published: Mar 15, 2022
- Affected: through 1.2.11.

### [CVE-2022-0954](https://cve.now/CVE-2022-0954): Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops'…

- Severity: Medium 6.8
- Published: Mar 15, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0930](https://cve.now/CVE-2022-0930): File upload filter bypass leading to stored XSS in microweber/microweber

- Severity: High 8.0
- Published: Mar 12, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0929](https://cve.now/CVE-2022-0929): XSS on dynamic\_text module in microweber/microweber

- Severity: Medium 6.8
- Published: Mar 12, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0926](https://cve.now/CVE-2022-0926): File upload filter bypass leading to stored XSS in microweber/microweber

- Severity: High 7.1
- Published: Mar 12, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0921](https://cve.now/CVE-2022-0921): Abusing Backup/Restore feature to achieve Remote Code Execution in microweber/microweber

- Severity: High 7.2
- Published: Mar 11, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0928](https://cve.now/CVE-2022-0928): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 6.8
- Published: Mar 11, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0912](https://cve.now/CVE-2022-0912): Unrestricted Upload of File with Dangerous Type in microweber/microweber

- Severity: Medium 4.8
- Published: Mar 11, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0913](https://cve.now/CVE-2022-0913): Integer Overflow or Wraparound in microweber/microweber

- Severity: Critical 9.1
- Published: Mar 11, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0906](https://cve.now/CVE-2022-0906): Unrestricted file upload leads to stored XSS in microweber/microweber

- Severity: Medium 4.3
- Published: Mar 10, 2022
- Affected: fixed in 1.2.12.

### [CVE-2022-0895](https://cve.now/CVE-2022-0895): Static Code Injection in microweber/microweber

- Severity: High 7.7
- Published: Mar 10, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0896](https://cve.now/CVE-2022-0896): Improper Neutralization of Special Elements Used in a Template Engine in microweber/microweber

- Severity: High 7.1
- Published: Mar 9, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0777](https://cve.now/CVE-2022-0777): Weak Password Recovery Mechanism for Forgotten Password in microweber/microweber

- Severity: High 7.3
- Published: Mar 1, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0723](https://cve.now/CVE-2022-0723): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: High 8.0
- Published: Feb 26, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0763](https://cve.now/CVE-2022-0763): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Medium 4.3
- Published: Feb 26, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0762](https://cve.now/CVE-2022-0762): Incorrect Authorization in microweber/microweber

- Severity: Medium 5.5
- Published: Feb 26, 2022
- Affected: fixed in 1.3.0.

### [CVE-2022-0724](https://cve.now/CVE-2022-0724): Insecure Storage of Sensitive Information in microweber/microweber

- Severity: Critical 9.1
- Published: Feb 23, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0721](https://cve.now/CVE-2022-0721): Insertion of Sensitive Information Into Debugging Code in microweber/microweber

- Severity: High 8.8
- Published: Feb 23, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0719](https://cve.now/CVE-2022-0719): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: High 7.6
- Published: Feb 23, 2022
- Affected: fixed in 1.3.

### [CVE-2022-0688](https://cve.now/CVE-2022-0688): Business Logic Errors in microweber/microweber

- Severity: Critical 9.4
- Published: Feb 20, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0690](https://cve.now/CVE-2022-0690): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: High 8.8
- Published: Feb 19, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0689](https://cve.now/CVE-2022-0689): Use multiple time the one-time coupon in microweber/microweber

- Severity: Medium 5.3
- Published: Feb 19, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0678](https://cve.now/CVE-2022-0678): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: Medium 6.5
- Published: Feb 19, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0666](https://cve.now/CVE-2022-0666): CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in microweber/microweber

- Severity: High 7.6
- Published: Feb 18, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0660](https://cve.now/CVE-2022-0660): Generation of Error Message Containing Sensitive Information in microweber/microweber

- Severity: Critical 9.4
- Published: Feb 18, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0638](https://cve.now/CVE-2022-0638): Cross-Site Request Forgery (CSRF) in microweber/microweber

- Severity: Medium 4.3
- Published: Feb 17, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0597](https://cve.now/CVE-2022-0597): Open Redirect in microweber/microweber

- Severity: Medium 4.3
- Published: Feb 15, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0596](https://cve.now/CVE-2022-0596): Improper Validation of Specified Quantity in Input in microweber/microweber

- Severity: Medium 5.4
- Published: Feb 15, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0560](https://cve.now/CVE-2022-0560): Open Redirect in microweber/microweber

- Severity: Medium 4.3
- Published: Feb 11, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0557](https://cve.now/CVE-2022-0557): OS Command Injection in microweber/microweber

- Severity: High 8.1
- Published: Feb 11, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0558](https://cve.now/CVE-2022-0558): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: Critical 9.8
- Published: Feb 10, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0504](https://cve.now/CVE-2022-0504): Generation of Error Message Containing Sensitive Information in microweber/microweber

- Severity: Medium 6.5
- Published: Feb 8, 2022
- Affected: through 1.2.10.

### [CVE-2022-0505](https://cve.now/CVE-2022-0505): Cross-Site Request Forgery (CSRF) in microweber/microweber

- Severity: Medium 5.7
- Published: Feb 8, 2022
- Affected: through 1.2.10.

### [CVE-2022-0506](https://cve.now/CVE-2022-0506): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: High 7.7
- Published: Feb 8, 2022
- Affected: through 1.2.10.

### [CVE-2022-0378](https://cve.now/CVE-2022-0378): Cross-site Scripting (XSS) - Reflected in microweber/microweber

- Severity: High 7.1
- Published: Jan 26, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0379](https://cve.now/CVE-2022-0379): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: High 8.1
- Published: Jan 26, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0282](https://cve.now/CVE-2022-0282): Cross-site Scripting in microweber/microweber

- Severity: Medium 4.3
- Published: Jan 20, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0281](https://cve.now/CVE-2022-0281): Exposure of Sensitive Information to an Unauthorized Actor in microweber/microweber

- Severity: High 7.5
- Published: Jan 20, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0278](https://cve.now/CVE-2022-0278): Cross-site Scripting (XSS) - Stored in microweber/microweber

- Severity: High 7.2
- Published: Jan 20, 2022
- Affected: fixed in 1.2.11.

### [CVE-2022-0277](https://cve.now/CVE-2022-0277): Incorrect Permission Assignment for Critical Resource in microweber/microweber

- Severity: Medium 6.5
- Published: Jan 20, 2022
- Affected: fixed in 1.2.11.

### [CVE-2021-33988](https://cve.now/CVE-2021-33988): Cross Site Scripting (XSS).

- Severity: Unrated
- Published: Oct 19, 2021
- Affected: fixed in 1.2.8.

### [CVE-2020-28337](https://cve.now/CVE-2020-28337): A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code…

- Severity: Unrated
- Published: Feb 15, 2021
- Affected: fixed in 1.2.3.

### [CVE-2020-23136](https://cve.now/CVE-2020-23136): Microweber v1.1.18 is affected by no session expiry after log-out.

- Severity: Unrated
- Published: Nov 9, 2020
- Affected: versions 1.1.18.

### [CVE-2020-13405](https://cve.now/CVE-2020-13405): userfiles/modules/users/controller/controller.php in Microweber before 1.1.20 allows an unauthenticated user to disclose the users…

- Severity: Unrated
- Published: Jul 16, 2020
- Affected: fixed in 1.1.20.

### [CVE-2020-13241](https://cve.now/CVE-2020-13241): Microweber 1.1.18 allows Unrestricted File Upload because admin/view:modules/load\_module:users#edit-user=1 does not verify that the file…

- Severity: Unrated
- Published: May 20, 2020
- Affected: through 1.1.18.

### [CVE-2018-19917](https://cve.now/CVE-2018-19917): Microweber 1.0.8 has reflected cross-site scripting (XSS) vulnerabilities.

- Severity: Unrated
- Published: Mar 17, 2019
- Affected: through 1.0.8.

### [CVE-2018-1000826](https://cve.now/CVE-2018-1000826): Microweber version \<= 1.0.7 contains a Cross Site Scripting (XSS) vulnerability in Admin login form template that can result in Execution…

- Severity: Unrated
- Published: Dec 20, 2018
- Affected: fixed in 1.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/microweber/microweber
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.